Collecting Endpoint Logs with Elastic Agent

[@Angry.Hippie]

This video series has been a great help in getting me hands on experience for the CySA+ cert. Wouldn't of been able to install an agent on my computer without it!

[@security-onion]

Thanks, glad to help!

[@fuzzyEuclid]

Thank you for the quick look! I'd love to see a basic osquery video :)

[@waseemalkurdi759]

Thank you, It's very useful video.

[@security-onion]

Thanks, glad you like it!

[@subhuman7478]

I would also love to see an osquery video. A strelka one would be great too.

[@taraskobilskiy6538]

Thank you for the video

[@security-onion]

You're welcome!

[@calmeidazim]

Thank you, just in the time :)

[@security-onion]

You're welcome!

[@edvloesungen]

Thank you very much!

[@security-onion]

You're welcome!

[@CageYim]

I saw "Evaluation installs and Import installs do not support remote elastic agents. The links below are shown for demonstration purposes only." after I installed the eval version security onion following your installation guide video, is that means I have to install to other mode? Thank you.

[@security-onion]

If you want to deploy the Elastic Agent to remote devices, then you will need to install in STANDALONE mode or do a full distributed deployment. For more information, please see the documentation at docs.securityonion.net/en/2.4/architecture.html. If you have further questions or problems, please start a new discussion at securityonion.com/discuss. Thanks!

[@CageYim]

@@security-onion Thank you very much. Let me try again.

[@zapphoddbubbahbrox5681]

somehow SYSMON integration not working or showing up as an integration for a windows box. i'd added SYSMON to the node after the agent was enrolled. does this require removal (big pains here also, it won't properly remove)? Would be great to have a guide for this. Also for Linux SYSMON

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.com/discuss

[@JamesHazell-b2p]

Great information. Is there a video to port Cisco switch log files to SO ?

[@security-onion]

Please see the Cisco IOS integration at docs.elastic.co/integrations/cisco_ios and our docs at docs.securityonion.net/en/2.4/elastic-fleet.html#elastic-fleet and docs.securityonion.net/en/2.4/elastic-agent.html. If you have further questions or problems, please start a new discussion at securityonion.com/discuss

[@fuzzyEuclid]

An osquery video would be awesome :)

[@sevadamuradyan5486]

our network firewall log is coming to my computer how can i send sec-onion?

[@security-onion]

If you have questions or problems, please start a new discussion at securityonion.net/discuss

[@WatsonInfosec]

Thanks

[@security-onion]

You're welcome!